RADIUS (NGS) is not disconnecting users

Question

Hi,
I have a guest network set up on a WLC with an external RADIUS server (NAC Guest Server). However when the time profile expires (user account expires) on NGS the active user is not disconnected.
Now if the user logs off the guest network (either using the logout window or via the idle/session timeout) and tries to log back in they correctly get an error message when they try and log back in on the portal. The issue is that active users are not getting foraceably logged off the guest network.
I'm sure i've seen this issue referenced somewhere before but I couldnt find it.
Eoin.

Answer 1

the key point is that Radius is an authentication that happens when the client connects. The Radius server cannot take actions unless it is contacted in the first place so a radius server cannot kick users.
This is "too bad" and yes things are coming to change that. The new versions of IOS switches start to support "Radius Change of Authorization" that allows the radius server to kick people on demand etc ... But that's not yet there.
The session timeout is the time for which the WLC leaves the client in peace before asking for a reauthentication.
For a WPA SSID, the client laptop will automatically reprovide credentials after timeout usually so it's a smooth reauthentication. But for guest, if the authentication method is a login page, the user will have to re-enter his credentials and if he was doing a file transfer, that got interrupted so that's not cool to set a very small session timeout.
So you have to decide I'm afraid to set a session timeout of 2 hours let's say, time that you find acceptable to have to reauthenticate again. This means that the clients will definitely not be able to have network access 2 hours (maximum ! once their NGS user account expires, they will be kicked at the next reauthentication which happens between 0 and 120 minutes later) after their account expired.
Nicolas